This apache version update fixes various security and non security issues.

  - Updated to the 2.2.29

  - Changes between 2.2.22 and 2.2.29:
    http://www.apache.org/dist/httpd/CHANGES_2.2

  - The following patches are no longer needed and were     removed :

    - httpd-2.2.x-bnc798733-SNI_ignorecase.diff

    - httpd-2.2.x-bnc806458-mod_imagemap-xss.diff

    - httpd-2.2.x-bnc806458-mod_info_ap_get_server_name-xss.diff

    - httpd-2.2.x-bnc806458-mod_proxy_ftp-xss.diff

    - httpd-2.2.x-bnc806458-util_ldap_cache_mgr-xss.diff

    - httpd-2.2.x-bnc807152-mod_balancer_handler_xss.diff

    - httpd-mod_deflate_head.patch

    - httpd-new_pcre.patch

    - httpd-2.2.22-SSLCompression_CRIME_mitigation.patch

    - httpd-2.2.19-linux3.patch

    - httpd-2.2.x-bnc829056-CVE-2013-1896-pr1482522-mod_dav.diff

    - httpd-2.2.x-bnc829057-CVE-2013-1862-mod_rewrite_terminal_escape_sequences.diff

    - httpd-2.2.x-bnc869105-CVE-2013-6438-mod_dav-dos.diff

    - httpd-2.2.x-bnc869106-CVE-2014-0098-log_cookie_c.diff

    - httpd-2.2.x-bnc887765-CVE-2014-0226-mod_status_race.diff

    - httpd-2.2.x-bnc887768-CVE-2014-0231_mod_cgid_DoS_via_no_stdin_read.diff

    - httpd-2.2.x-bnc777260-CVE-2012-2687-mod_negotiation_filename_xss.diff

    - httpd-2.2.x-CVE-2011-3368-server_protocl_c.diff

  - The following patches were updated for the current     Apache version :

  - apache2-mod_ssl_npn.patch

    - httpd-2.0.54-envvars.dif

    - httpd-2.2.x-bnc690734.patch

  - ssl-mode-release-buffers.patch

  - bnc#871310 fixed in Apache httpd 2.2.29

This update contains the latest stable release of the Apace HTTP Server, version 2.2.22. This release fixes various bugs, and the following security issues :

  - Reject requests where the request-URI does not match the     HTTP specification, preventing unexpected expansion of     target URLs in some reverse proxy configurations.
    (CVE-2011-3368)

  - Fix integer overflow in ap_pregsub() which, when the     mod_setenvif module is enabled, could allow local users     to gain privileges via a .htaccess file. (CVE-2011-3607)

  - Resolve additional cases of URL rewriting with     ProxyPassMatch or RewriteRule, where particular     request-URIs could result in undesired backend network     exposure in some configurations. (CVE-2011-4317)

  - mod_log_config: Fix segfault (crash) when the     '%{cookiename}C' log format string is in use and a     client sends a nameless, valueless cookie, causing a     denial of service. The issue existed since version     2.2.17. (CVE-2012-0021)

  - Fix scoreboard issue which could allow an unprivileged     child process could cause the parent to crash at     shutdown rather than terminate cleanly. (CVE-2012-0031)

  - Fixed an issue in error responses that could expose     'httpOnly' cookies when no custom ErrorDocument is     specified for status code 400. (CVE-2012-0053)

http://www.apache.org/dist/httpd/CHANGES_2.2.22

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the mod_proxy module in Apache did not properly interact with the RewriteRule and ProxyPassMatch pattern matches in the configuration of a reverse proxy. This could allow remote attackers to contact internal webservers behind the proxy that were not intended for external exposure. (CVE-2011-3368)

Stefano Nichele discovered that the mod_proxy_ajp module in Apache when used with mod_proxy_balancer in certain configurations could allow remote attackers to cause a denial of service via a malformed HTTP request. (CVE-2011-3348)

Samuel Montosa discovered that the ITK Multi-Processing Module for Apache did not properly handle certain configuration sections that specify NiceValue but not AssignUserID, preventing Apache from dropping privileges correctly. This issue only affected Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. (CVE-2011-1176)

USN 1199-1 fixed a vulnerability in the byterange filter of Apache.
The upstream patch introduced a regression in Apache when handling specific byte range requests. This update fixes the issue.

A flaw was discovered in the byterange filter in Apache. A remote attacker could exploit this to cause a denial of service via resource exhaustion.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Apache HTTP Server is a popular web server.

It was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. In certain configurations, if a reverse proxy used the ProxyPassMatch directive, or if it used the RewriteRule directive with the proxy flag, a remote attacker could make the proxy connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to the attacker. (CVE-2011-3368)

This update also fixes the following bug :

  - The fix for CVE-2011-3192 provided by a previous update     introduced regressions in the way httpd handled certain     Range HTTP header values. This update corrects those     regressions.

All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

It was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. In certain configurations, if a reverse proxy used the ProxyPassMatch directive, or if it used the RewriteRule directive with the proxy flag, a remote attacker could make the proxy connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to the attacker. (CVE-2011-3368)

It was discovered that mod_proxy_ajp incorrectly returned an 'Internal Server Error' response when processing certain malformed HTTP requests, which caused the back-end server to be marked as failed in configurations where mod_proxy was used in load balancer mode. A remote attacker could cause mod_proxy to not send requests to back-end AJP (Apache JServ Protocol) servers for the retry timeout period or until all back-end servers were marked as failed. (CVE-2011-3348)

The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2011-346:03 advisory.

    The Apache HTTP Server is a powerful, efficient, and extensible web server.
    Security issues fixed with this release:
    CVE-2011-3368     The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x     through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern     matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet     servers via a malformed URI containing an initial @ (at sign) character.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-07:01 advisory.

    The Apache HTTP Server is a powerful, efficient, and extensible web server.
    Security issues fixed with this release:
    CVE-2011-3348     The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in     certain configurations, allows remote attackers to cause a denial of service (temporary error state in the     backend server) via a malformed HTTP request.
    CVE-2011-3368     The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x     through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern     matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet     servers via a malformed URI containing an initial @ (at sign) character.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes the following issues :

  - Denial of Service via special requests in mod_proxy_ajp.
    (CVE-2012-4557)

  - improper LD_LIBRARY_PATH handling. (CVE-2012-0883)

  - filename escaping problem Additionally, some     non-security bugs have been fixed:. (CVE-2012-2687)

  - ignore case when checking against SNI server names.
    [bnc#798733]

  - httpd-2.2.x-CVE-2011-3368_CVE-2011-4317-bnc722545.diff     reworked to reflect the upstream changes. This will     prevent the 'Invalid URI in request OPTIONS *' messages     in the error log. [bnc#722545]

  - new sysconfig variable APACHE_DISABLE_SSL_COMPRESSION;
    if set to on, OPENSSL_NO_DEFAULT_ZLIB will be inherited     to the apache process; openssl will then transparently     disable compression. This change affects start script     and sysconfig fillup template. Default is on, SSL     compression disabled. Please see mod_deflate for     compressed transfer at http layer. [bnc#782956]

This update fixes several security issues in the Apache2 webserver.

CVE-2011-3368, CVE-2011-4317: This update also includes several fixes for a mod_proxy reverse exposure via RewriteRule or ProxyPassMatch directives.

CVE-2011-3607: Integer overflow in ap_pregsub function resulting in a heap based buffer overflow could potentially allow local attackers to gain privileges

In addition to that the following changes were made :

  - new template file:
    /etc/apache2/vhosts.d/vhost-ssl.template allow TLSv1     only, browser match stuff commented out.

  - rc script /etc/init.d/apache2: handle reload with     deleted binaries by message to stdout only, but refrain     from sending signals.

- httpd-2.2.x-bnc727071-mod_authnz_ldap-utf8.diff: make non-ascii eg UTF8 passwords work with mod_authnz_ldap.
[bnc#727071]

According to its banner, the version of Apache 2.2.x installed on the remote host is prior to 2.2.22. It is, therefore, potentially affected by the following vulnerabilities :

  - When configured as a reverse proxy, improper use of the     RewriteRule and ProxyPassMatch directives could cause     the web server to proxy requests to arbitrary hosts.
    This could allow a remote attacker to indirectly send     requests to intranet servers.
    (CVE-2011-3368, CVE-2011-4317)

  - A heap-based buffer overflow exists when mod_setenvif     module is enabled and both a maliciously crafted     'SetEnvIf' directive and a maliciously crafted HTTP     request header are used. (CVE-2011-3607)

  - A format string handling error can allow the server to     be crashed via maliciously crafted cookies.
    (CVE-2012-0021)

  - An error exists in 'scoreboard.c' that can allow local     attackers to crash the server during shutdown.
    (CVE-2012-0031)

  - An error exists in 'protocol.c' that can allow     'HTTPOnly' cookies to be exposed to attackers through     the malicious use of either long or malformed HTTP     headers. (CVE-2012-0053)

  - An error in the mod_proxy_ajp module when used to     connect to a backend server that takes an overly long     time to respond could lead to a temporary denial of     service. (CVE-2012-4557)

Note that Nessus did not actually test for these flaws, but instead has relied on the version in the server's banner.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1391 advisory.

    - add security fixes for CVE-2011-3347, CVE-2011-3368 (#743901)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache HTTP Server running on the remote host is affected by an information disclosure vulnerability. When configured as a reverse proxy, improper use of the RewriteRule and ProxyPassMatch directives could cause the web server to proxy requests to arbitrary hosts. This allows a remote attacker to indirectly send requests to intranet servers.

Several vulnerabilities have been found in the Apache HTTPD Server :

  - CVE-2011-3607 :
    An integer overflow in ap_pregsub() could allow local     attackers to execute arbitrary code at elevated     privileges via crafted .htaccess files.

  - CVE-2011-3368 CVE-2011-3639 CVE-2011-4317 :
    The Apache HTTP Server did not properly validate the     request URI for proxied requests. In certain reverse     proxy configurations using the ProxyPassMatch directive     or using the RewriteRule directive with the [P] flag, a     remote attacker could make the proxy connect to an     arbitrary server. This could allow the attacker to     access internal servers that are not otherwise     accessible from the outside.

  The three CVE ids denote slightly different variants of the same   issue.

  Note that, even with this issue fixed, it is the responsibility of   the administrator to ensure that the regular expression replacement   pattern for the target URI does not allow a client to append   arbitrary strings to the host or port parts of the target URI. For   example, the configuration

  ProxyPassMatch ^/mail(.*) http://internal-host$1

  is still insecure and should be replaced by one of the following   configurations :

  ProxyPassMatch ^/mail(/.*) http://internal-host$1 ProxyPassMatch   ^/mail/(.*) http://internal-host/$1

  - CVE-2012-0031 :
    An apache2 child process could cause the parent process     to crash during shutdown. This is a violation of the     privilege separation between the apache2 processes and     could potentially be used to worsen the impact of other     vulnerabilities.

  - CVE-2012-0053 :
    The response message for error code 400 (bad request)     could be used to expose 'httpOnly' cookies. This could     allow a remote attacker using cross site scripting to     steal authentication cookies.

This update brings Apache to version 2.2.12.

The main reason is the enablement of the Server Name Indication (SNI) that allows several SSL-enabled domains on one IP address (FATE#311973). See the SSLStrictSNIVHostCheck directive as documented in /usr/share/apache2/manual/mod/mod_ssl.html.en

Also the patch for the ByteRange remote denial of service attack (CVE-2011-3192) was refined and the configuration options used by upstream were added.

Introduce new config option: Allow MaxRanges Number of ranges requested, if exceeded, the complete content is served. default: 200 0|unlimited: unlimited none: Range headers are ignored. This option is a backport from 2.2.21.

Also fixed were

  - Denial of service in proxy_ajp when using a undefined     method. (CVE-2011-3348)

  - Exposure of internal servers via reverse proxy methods     with mod_proxy enabled and incorrect Rewrite or Proxy     Rules. This update also includes a newer     apache2-vhost-ssl.template, which disables SSLv2, and     allows SSLv3 and strong ciphers only. Please note that     existing vhosts will not be converted. (CVE-2011-3368)

This update fixes several security issues in the Apache2 webserver.

  - This update also includes several fixes for a mod_proxy     reverse exposure via RewriteRule or ProxyPassMatch     directives. (CVE-2011-3639 / CVE-2011-3368 /     CVE-2011-4317)

  - Fixed the SSL renegotiation DoS by disabling     renegotiation by default. (CVE-2011-1473)

  - Integer overflow in ap_pregsub function resulting in a     heap-based buffer overflow could potentially allow local     attackers to gain privileges. (CVE-2011-3607)

Also a non-security bug was fixed :

  - httpd-2.2.x-bnc727071-mod_authnz_ldap-utf8.diff: make     non-ascii eg UTF8 passwords work with mod_authnz_ldap.
    [bnc#727071]

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
80043	openSUSE Security Update : apache2 (openSUSE-SU-2014:1647-1)	Nessus	SuSE Local Security Checks	2014/12/16	2021/1/19	medium
58050	Fedora 16 : httpd-2.2.22-1.fc16 (2012-1598)	Nessus	Fedora Local Security Checks	2012/2/21	2021/1/11	medium
56778	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : apache2, apache2-mpm-itk vulnerabilities (USN-1259-1)	Nessus	Ubuntu Local Security Checks	2011/11/11	2019/9/19	medium
61160	Scientific Linux Security Update : httpd on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
78270	Amazon Linux AMI : httpd (ALAS-2011-9)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2018/4/18	medium
284243	MiracleLinux 3 : httpd-2.2.3-53.3.0.1.AXS3 (AXSA:2011-346:03)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	high
284286	MiracleLinux 4 : httpd-2.2.15-9.3.0.1.AXS4 (AXSA:2012-07:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	high
65023	SuSE 11.2 Security Update : Apache (SAT Patch Number 7409)	Nessus	SuSE Local Security Checks	2013/3/5	2021/1/19	medium
75427	openSUSE Security Update : apache2 (openSUSE-SU-2012:0248-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
57791	Apache 2.2.x < 2.2.22 Multiple Vulnerabilities	Nessus	Web Servers	2012/2/2	2018/6/29	medium
68376	Oracle Linux 6 : httpd (ELSA-2011-1391)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	high
56972	Apache HTTP Server mod_proxy Reverse Proxy Information Disclosure	Nessus	Web Servers	2011/11/29	2018/6/27	medium
57851	Debian DSA-2405-1 : apache2 - multiple issues	Nessus	Debian Local Security Checks	2012/2/7	2021/1/11	medium
58252	Fedora 15 : httpd-2.2.22-1.fc15 (2012-1642)	Nessus	Fedora Local Security Checks	2012/3/7	2021/1/11	medium
57089	SuSE 11.1 Security Update : Apache2 (SAT Patch Number 5344)	Nessus	SuSE Local Security Checks	2011/12/13	2021/1/19	high
57090	SuSE 11.1 Security Update : Apache2 (SAT Patch Number 5482)	Nessus	SuSE Local Security Checks	2011/12/13	2021/1/19	medium

检测

插件搜索

medium

medium

medium

medium

medium

high

high

medium

medium

medium

high

medium

medium

medium

high

medium